main-branch.json

{
  "_comment": "Reviewable source for live repository ruleset 18752848. Applied 2026-07-11: every main update must come through a PR, all required checks must pass against current main, force-push/deletion are blocked, and no actor can bypass. Approval count remains 0 under ADR 0006 while the project has one active maintainer.",
  "name": "protect-main",
  "target": "branch",
  "enforcement": "active",
  "conditions": {
    "ref_name": { "include": ["refs/heads/main"], "exclude": [] }
  },
  "rules": [
    { "type": "deletion" },
    { "type": "non_fast_forward" },
    {
      "type": "pull_request",
      "parameters": {
        "allowed_merge_methods": ["merge", "squash", "rebase"],
        "dismiss_stale_reviews_on_push": false,
        "require_code_owner_review": false,
        "require_last_push_approval": false,
        "required_approving_review_count": 0,
        "required_review_thread_resolution": true
      }
    },
    {
      "type": "required_status_checks",
      "parameters": {
        "do_not_enforce_on_create": false,
        "strict_required_status_checks_policy": true,
        "required_status_checks": [
          { "context": "lint · types · tests (the merge gate)" },
          { "context": "verifier subset compiles on older Pythons (3.12)" },
          { "context": "verifier subset compiles on older Pythons (3.13)" },
          { "context": "secret scanning (gitleaks)" },
          { "context": "dependency vulnerability audit" },
          { "context": "axe-core WCAG scan (merge gate)" },
          { "context": "mechanical i18n gates — UTF-8 · BCP 47 · EN/ES parity (merge gate)" },
          { "context": "CodeQL (python)" },
          { "context": "CodeQL (actions)" },
          { "context": "Trivy image scan (relay)" }
        ]
      }
    }
  ],
  "bypass_actors": []
}